-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 12 Nov 2026 17:45:25 +0000 Source: dbus Architecture: source Version: 1.16.4-1 Distribution: unstable Urgency: medium Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org> Changed-By: Simon McVittie <smcv@debian.org> Closes: 1153841 1153842 Changes: dbus (1.16.4-1) unstable; urgency=medium . * New upstream release fixing several local denial-of-service issues - Prevent local attacker from making `dbus-daemon --system` cause excessive single-CPU load (RHEL-239613, dbus#587; Closes: #1153842) - Prevent local attacker from crashing `dbus-daemon --system` if a privileged user is using monitoring tools on it + Mitigation: The vulnerability is not exploitable unless a privileged user is using monitoring tools (CVE-2026-120749; Closes: #1153841) - Prevent local attacker from making dbus-daemon or DBusServer unresponsive if configured to listen on the nonce-tcp: transport + Mitigation: The nonce-tcp: transport should not be used on multi-user systems (RHEL-239294, dbus#586; Closes: #1153842) - Prevent additional denial-of-service issues on non-Linux platforms * d/control: Update short description of dbus-user-session * d/control: dh-sequence-installsysusers is enabled by default in compat 14, stop enabling it explicitly Checksums-Sha1: c8b5dfc355c368e008bbf47c98510cd72e0cbf57 4165 dbus_1.16.4-1.dsc b04dbe37d49f0f0e168f9a978239fff83ff2ef71 1124660 dbus_1.16.4.orig.tar.xz b365fd4359a55dca3df5fbaad9952d0de49aa560 833 dbus_1.16.4.orig.tar.xz.asc a340f51da4d6f5310cb1eeea4966d872f0c4a7b4 72504 dbus_1.16.4-1.debian.tar.xz 3acb8c7e5e193c92fa37d859d9a54df11356afde 2729276 dbus_1.16.4-1.git.tar.xz 5bec1f4de40b3d884ab0f23c9db29302fe72676c 17734 dbus_1.16.4-1_source.buildinfo Checksums-Sha256: b0780380130c8fe75853108b5a9d35eddc70aa63ebda07090fd52321a0c6a30f 4165 dbus_1.16.4-1.dsc d08b05526c2cb7966a5fb79210d6112b1aca3d135f315c1b302e14b4b0297dac 1124660 dbus_1.16.4.orig.tar.xz 7fec4d446090304ee8c97fa6c066c2c01ba09cd930cfa33939626023971b3168 833 dbus_1.16.4.orig.tar.xz.asc 29dce1c7cca43cfc917c0502420e3f2525aa159686b1b22dd4f1bfc7400cea56 72504 dbus_1.16.4-1.debian.tar.xz 904ae6b59eb1ec86076992552e15e351409aac5b0f9586987a3bccfdbdba75ef 2729276 dbus_1.16.4-1.git.tar.xz 6b6d62466b5e90ad3e310b7312d913068fad6834861af8c8178edd195d80d234 17734 dbus_1.16.4-1_source.buildinfo Files: 81d32d60bfe1e7b6696e0ec00dbd0eca 4165 admin optional dbus_1.16.4-1.dsc b7ed0057777e1aa1bca3348e1aaeedb2 1124660 admin optional dbus_1.16.4.orig.tar.xz dd5a13979d179009aed3eee1aed86954 833 admin optional dbus_1.16.4.orig.tar.xz.asc 15d99759b583518e7da553ffe8dce321 72504 admin optional dbus_1.16.4-1.debian.tar.xz 155ad681dc4dff6ee79b3e7791c074ae 2729276 admin None dbus_1.16.4-1.git.tar.xz d680481e523f09eef358bc331db886b9 17734 admin optional dbus_1.16.4-1_source.buildinfo Git-Tag-Info: tag=1731cda884e8b9ce83398a361edac99bba12e84b fp=7a073ad1ae694fa25bff62e5235c099d3eb33076 Git-Tag-Tagger: Simon McVittie <smcv@debian.org> -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmr1/REACgkQYG0ITkaD wHn9EQ//RTWgVi92CjUsnQPBylsBxTA3iPdoBTEUmVyfRWHgJstgMa23kEdXBIJ0 Sr7kRhqKR7KoT4bObyS6LZ5Kt6jebk0n3cIMUNecz19MsdEcb6VWyS6C4uj54L+3 qncGlQR/EfMqtNttRVJ6WMr35sHHuKdItHxZkkKtH0cEgrLWITVn+F8a3kyP8xhA BV3gYM6lx62pyeEcYZuMA1CN3GCy+CQAk73/uLg2kqX6S6TSYtQKLCCzLzFlK11r fY5BgCENLZ7l8h5Zmu2XebsI+BADuVHhdo6p4n4CoAWZq2pUm1RHo+xGev0TmJFT 2FcyHX/8PLuUcEIP0KFjM9wTIt6VtOHBuvcQqDJ+/CTmx6poGUxXHEfKPDeGUmaf ZUoo1Pxap9uLnFQLzKdrhYnigwhDepiI3QbYD4RhkN4Q5Wqz7qpxnRK06VrBhrcr pBZC9CEdUBRMAQCbycDurlgswPwwIyDyETsST14jPZYUyOVrMPLp8C//N4Q86eFG 10dGImVLZPV6OVo+AdVHaFf/0OKPaFBEpR01TEwcLrvxSyQ2RDGAaFXCbIjptbMs trAOBJRLFrHuHf/dCNu28pRhNcP6ZAE1P7nmF0kOg3XiMpXxSbdlak1KQpQUYTig rbOYuo7H43B7gdU6mI0hI4Fb5/5bLd6z8Ac5QRiEt6XooZ0Kk70= =ki+F -----END PGP SIGNATURE-----
